Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

SmokeLoader Malware Targets Ukraine’s Auto & Banking Sectors via Open Directories

hunt.io | blog | #banking | #ukraine | #open-directory | #smokeloader | #malware-loader | #lures

Summary

Open directories exposed SmokeLoader samples alongside invoice-themed lure documents targeting Ukraine's automotive and banking sectors, revealing the campaign's staging methods.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged
An exposed Hong Kong staging server revealed Hermes, an autonomous AI agent run unattended, an unreported Go implant named Hades, and tooling targeting Thailand's Ministry of Finance.
blog · hunt.io
Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Finance Across Eleven Countries
An exposed open directory reveals an operator staging NGINX Rift, Ghost CMS, and other recent CVEs against government and finance, using DNS callbacks to verify execution.
blog · hunt.io
Ababil of Minab Exposed: LA Metro SCADA Backups and Israeli Victim Data Left Open on an Iranian Staging Server
Hunt.io AttackCapture found Ababil of Minab's staging server wide open: 5 GB of victim data including LA Metro SCADA backups and Israeli organizations' credentials, configs, and database dumps.
blog · hunt.io
Exposed BYOB C2 Infrastructure Reveals a Multi-Stage Malware Deployment
A live BYOB C2 open directory revealed a multi-stage deployment: droppers, stagers and post-exploitation modules for Windows, Linux and macOS, seven persistence mechanisms, plus XMRig miners.
blog · hunt.io
AsyncRAT Campaigns Uncovered: How Attackers Abuse ScreenConnect and Open Directories
ConnectWise ScreenConnect installers were trojanized to deliver AsyncRAT from at least eight hosts, with payloads unseen on VirusTotal, ClickOnce /Bin/ pivots and scheduled-task persistence.
blog · hunt.io
Cobalt Strike Operators Leverage PowerShell Loaders Across Chinese, Russian, and Global Infrastructure
A PowerShell shellcode loader found in a Chinese open directory executes in memory, fetches stage two from Baidu Cloud Functions, and beacons to Cobalt Strike infrastructure in Russia.
back